MassMediaLink India LLP SecurityLink India - securitylinkindia

New NIST Forensic Tests

MassMediaLink India LLP SecurityLink IndiaJanuary 27, 2018November 14, 202406 mins

Data found on a suspect’s computer, cell phone or tablet can prove to be crucial evidence in a legal case. A new set of software tools developed at the National Institute of Standards and Technology (NIST) aims to make sure this digital evidence will hold up in the court. The software suite, referred to collectively as federated testing tools, is designed to help law enforcement and forensic practitioners with a critical early step in evidence collection – making a copy of the data from a seized electronic device. Because a suspect’s guilt or innocence can hang in the balance, both the prosecution and the defense must agree that the digital forensic process did not introduce any unseen errors into the data, and that the methods they are using work as expected. Extracting and copying data is a risky process because of the rapidly shifting digital landscape that the devices inhabit. Confronting the practitioners are all the differences in data and format that can exist between one device and the next – because of the sheer number of different manufacturers, and because of the frequent software updates pushed to various makes and models. “It’s hard to keep up,” said Barbara Guttman, one of the suite’s developers at NIST’s Computer Forensics Tool Testing project, “You don’t want to risk your copying software failing when you try to get data from some new computer that is critical to your case. So, we created these tools to help ensure that the copying software works effectively and transparently.” The federated testing tools allow authorities to run tests in advance on their digital forensic software to make sure ahead of time that it will not fail them when a suspect’s personal computer, media or device arrives in the forensic science lab. Guttman describes the suite as the three most critical tools for evidence acquisition and preservation, each addressing one aspect of the copying process. “One tool tests software for copying computer disks, while another tests mobile device data extraction software. These two test protocols were available previously, but the suite is now completed with a new third test for ‘write blockers,’ which are a sort of one-way valve for data-copying software. An effective write blocker allows data to flow only from the seized device to the copying computer, not the other way around. Later updates to the suite will address additional forensic functions,” said Guttman. The full suite is a freely available Linux file that anyone can download and burn to a blank CD. They can use the disk to boot their workstation and test their copying tools via a user-friendly interface. The NIST software also allows different forensics labs to exchange the results of their tests with each other, so that they can share the burden of exploring how well a copying method works on a specific platform and operating system. Running copying software through its paces generates a report that disparate organizations can share among themselves or with the world, allowing them to indicate whether they found anomalies during the testing or not. “Pooling these traceable results will mean less work for any given lab or organization,” Guttman said, “We don’t require they share the tests, but a rising tide should raise all boats.” Guttman cautioned that the tools will not ensure that a copying or digital forensic process is flawless, only that the results of the job are clearly visible to anyone. “Evidence doesn’t have to be complete to be admissible,” she said, “The key here is that copying does not introduce errors into the data that no one can see.” “Interest in federated testing will go beyond law enforcement agencies,” Guttman added, “Any organization that performs forensics such as civil law firms and corporate enforcement offices, will find a use for the test suite.”

Maximising the Benefits of C3 (Command & Control Centre)

MassMediaLink India LLP SecurityLink IndiaJanuary 25, 2018November 14, 2024039 mins

A command and control centre (CCC), by definition, centralises the monitoring, control and command of an organisation’s overall operations. It is most often associated with crisis or disaster management in the context of a city or state government body, police or even military agencies. It is also used by universities, transportation departments, utility companies, and any other organisations that need to manage distributed operations. Command centres have been a critical element for successful management of operations and/ or security management, and have been transforming with the advancements in the technological space. With the introduction of rapidly evolving new technologies, new organisational challenges and threats, command centre design and construction have become more complex and challenging than ever before. Today, CCCs need to be modular and should be equipped with correlation rules, process flows, rich algorithms, analytics, reporting, a geospatial platform, an Internet of things (IoT) platform, and other open platform systems. Since each organisation has its own specific needs and purposes for establishing such infrastructure, the command centre should be highly configurable, scalable and operator friendly. In the case of a city governance or safety body, a social media platform can cover voice, text, video, and mobile apps for citizens to interface with the CCC and thus take it to an entirely new level and provide better and efficient services to citizens. Challenges faced by organisations in the planning and operations of CCCs Perception of command centres today A CCC is a centre for information collection, analysis, decision making and management. Its primary purpose is to gather and process all the information required to plan and respond – quickly and effectively – to potential emergency incidents. The fig. 1 next page depicts the building blocks of a command and control solution, which primarily comprises field sensors as data collection points, database systems as information repositories, and communication systems as means for information dissemination, along with the key modules that empower information analysis and presentation of outcomes in a command centre application. The following are a few examples of factors driving the need for CCCs: Increasing technology dependence leading to the need for an integrated and efficient control and management platform. Efficient data handling needs for big data, data mining, analytics, IoT etc. Integrated view to address social, residential, commercial and national security needs. Need for reliable, flexible, sustainable, real-time and scalable systems to provide an integrated view of all sensors compatible with proprietary networks and legacy systems. Need for a collaborative work environment across teams working in silos at different locations. Disparate systems impacting operational efficiencies of businesses and driving up costs. Structured methodology for incident handling ensuring effective decision making and response. Transition from manual processes to system-defined automated or hybrid process. Evolution of command centres The concept of a command centre can be traced back to the 19th century and has continued to evolve since then. In conjunction with technological advancements, a new variety of threats have also arisen. However, each incident has fuelled innovations in counter response, resulting in further advancements in technologies. The fig. 2 next page represents the advancements in terms of threats and counter-response systems over the last three centuries. Establishment of a command centre Often, command centres are conceptualised at later stages of establishing the technology components and infrastructure, and in most of these cases, they end up as inadequate or unsuitable control rooms which are not able to achieve the organisational goals. The first and foremost step is to ensure that the functional goals and measurable key performance indicators are clearly defined at the pre-design stage itself. The selection of the right technologies and service level agreement (SLA) requirements is essential as it directly impacts the end results and the budget required for setting up such infrastructure. Once the functional requirements are documented, the requirements in terms of equipment specifications and other IT and non-IT requirements can be finalised. One of the key parameter for efficient operations of a command centre is defining an incident and its severity. This primarily helps in identification of associated stakeholders, operational process, sensors and systems for finalising the steps to be followed as part of the standard operating procedures (SOPs). Many a times we primarily emphasize upon the digital part only while forgetting about the importance of physical infrastructure design in the operations of a command centre. Being a monitoring and command centre which operates 24×7 for all 365 days of a year, the physical infrastructure for such a facility should be designed post considering the vital parameters such as ergonomics, seating layout in order of operational needs for better collaboration, secure and resilient operations. Once we are clear with the functional requirements and the physical infrastructural design, the next step shall be building capacities within the organisation for operating under such technologically advanced systems in line with the defined goals and KPIs for operations. A regular performance assessment and feedback process ensure that there is a continuous improvement in operating efficiency of the command centre by addressing the feedback for optimisation in relation to the people, process or systems. The last but not the least step is to devise a framework with periodic reporting of welldefined SLAs for measuring the KPIs through performance evaluation. Key challenges in today’s CCCs Presence of manual integrations A key indicator of a wrongly designed command centre is when manual integration of multiple information feeds is done by analysts to provide the operators the tools they need. This can lead to an inefficient utilisation of resources and time. Taking steps to train and improve the efficiency of operators, to derive information efficiently from the feeds puts them in a position to respond to events in a timelier manner, and potentially adds additional value to the organisation. Inconsistent information In many cases, there is a gap between the exchange of information between command centre operators and field personnel. This results in the loss of ‘crucial’ time and a loosely prepared response. Information overload Many command centres get information from various sources, but…

Ministry of Finance, Republic of Indonesia Trusted Matrix for Centralized Time- Attendance

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202403 mins

Financial management exists right from the era of kingdoms in Indonesia. Ministry of Finance is an institution under Indonesian Government, which has an important role in conducting economic development. Business challenges After having a word with the officials, Matrix found that the palm geometry readers got dirty when users placed their palm on its surface, and the devices were not able to reflect real-time attendance in the system. Hence, they were not getting correct time-attendance data for timely and accurate salary payment. To resolve this they wanted latest contactless technology for centralized time-attendance solution, which can connect its 141 locations with the head office in Jakarta. Furthermore, they needed a solution which could be easily integrated with their existing time-attendance and payroll software. Solution Matrix gave a comprehensive People Mobility Management Solution that took care of all their business challenges. The centralized solution connects 141 different locations with the COSEC CENTRA server at their corporate head office in Jakarta. Attendance of each employee can be marked from any location as all the terminals are interconnected with each other as well as with the central server through VPN network. User credentials will be transferred automatically to every device connected with the COSEC CENTRA server. It will prevent users to enroll at every location. Furthermore, Matrix provided COSEC DOOR PVR, which is a contactless technology that reads internal vascular pattern of palm and gives accurate results to provide utmost security and hygiene. These palm patterns are unique to each individual and exist underneath the skin layer so they cannot be faked, thereby making it more secure than any other biometric technology. Results Reduced salary calculation time by 80%. Improved productivity. Error free time-attendance data for salary. Faster decision making with the help of informative reports.

CP PLUS Outshines at Secutech Thailand

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202402 mins

CP PLUS outshines at Secutech, Thailand yet again. A long time participant of the show, CP PLUS pulled off a successful show this year with an elaborate display of its state-of-the-art security products and solutions. Up on showcase at the show were some of the best products and technologies from CP PLUS – Edge analytics that offer capabilities such as facial recognition, people counting, missing/ abandoned object detection, area protect and more; HD and Ultra HD surveillance that offers unmatched clarity and details; CP PLUS EzyKam, which offers the convenience of viewing home on the phone from anywhere in the world; advanced WDR offering incredible visibility in varying light conditions; and cutting-edge mobile DVR solutions that are 100% tamper proof, 100% shock resistant, 100% vibration resistant, and come with GPS tracking, Wi-Fi to transfer data, and super capacitor for power protection. The event saw an overwhelming response as visitors poured in through all the 3 days of the show, curious to learn about the technologies on showcase, and how they can be leveraged to secure their establishments. It was a great show. Months of hard work have gone into making this show a success, and to see the footfall volume gives us immense content and pleasure. We had some of our best solutions on display, such as our Edge analytics, advanced WDR solutions, mobile DVR solutions, HD solutions, among others. – Aditya Khemka MD, CP PLUS

Milestone Certified Arxys Video Storage

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202403 mins

Arxys Software Orchestrated Storage, Arxys | Shield, is now a Milestone Certified Solution. The testing and documentation were carried out with Milestone XProtect, the world’s leading open platform IP video management software (VMS). The certification verifies the interoperability of the tested solution with the full line of Milestone XProtect VMS offerings and describes a proven solution to deliver confidence and security for specifying, implementing and operating it. Benchmark capabilities “The Milestone Solution Certification shows the Arxys | Shield – Prime delivered the highest HD camera counts (2,944 cameras) and the highest total camera throughput (3.6Gb/s) of any storage platform tested to date by Milestone Systems,” said Mike Tarras, Solutions Integration Engineer for Milestone Systems, “These were all high-performance tests, with the goal of finding the maximum number of cameras which the system could support, given the video stream profile that was used.” The aim of these tests was to simulate video surveillance scenarios similar to those seen in the corrections and detention vertical market. In this sector, high definition video resolutions are required, with regulation retention periods that can be 180 days to 2 years. Video frame rates also need to be sufficient to capture human movement (12-15fps is minimally acceptable). In addition, busy correctional facilities can have very high camera counts, and are often co-located with medical facilities, law enforcement and other high-security areas, which leads to increased demands on the system performance. By combining storage, compute, networking and virtualization on commodity hardware, Arxys orchestrates the complexity of disparate systems into an optimized solution. The Arxys | Shield – Prime provides highly available (HA) storage resources for both the Milestone live video and archive databases with no single point of failure and full HA failover, redundancy and double parity data protection. “Security professionals demand robust data security plus maximum throughput regardless of the number of cameras or frame rates,” said Andy Newbom, VP Marketing of Arxys, “Arxys clients can achieve the highest throughput and camera counts at a dramatically lower TCO.” Milestone certifications focus on testing a solution’s architecture, functionality, performance impact and usability.

UNV : Navigator PTZ Dome Camera

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202404 mins

Uniview has recently launched new PTZ dome cameras IPC6322LR- X22-C and IPC6322SRX22P-C, which are named as Navigator. With outstanding performance and allweather design, Navigator refreshed the industry’s ability to provide cost effective products, and provided a brand new view for customers. Powerful engine Uniview has a rich experience on developing stepping motor due to several years of R&D accumulation. When designing Navigator, they chose a high quality and accurate stepping motor which is usually used in PTZ dome camera for high-end projects. The spin of Navigator is stable and smooth with out any mechanical jerk at 300 degrees per second which ensures that video is stable through all the time. Based on this motor, Navigator has strong performance of presetting. It has 1024 presets. The preset speed is up to 300 degrees per second, and the preset angle accuracy is within 0.1 degrees. These important presets can be easily configured as a patrol group and cruise promptly. All weather applicable In order to effectively reduce weather influence, Navigator is equipped with built-in fan and circle heater around window to remove snow or fog. Hence, image fidelity is guaranteed even under harsh environment. Outstanding design Outstanding design In addition, Navigator features 22X optical zoom with electronic image stabilizer for stable image at tilt range. It also has outstanding IR performance at ultra low light application. It has anti-reflection glass which can improve IR transmission by 8%, and the IR distance is up to 150m with car-grade LED. Navigator has a micro SD card slot, and using a SD card with up to 128GB storage space for edge storage, it can prevent unpredictable network connection breaks. It also supports IP66 and optional PoE power. Advanced software ability Except powerful hardware features, Navigator also support UNV Ultra 265 deep compression technology. Based on Hisilicon H.265 DSP and Uniview exclusive algorithm innovation, Ultra 265 helps produce high quality image but with less bit rate, and save more storage space. It also supports smart functions like crossing line detection, intrusion detection and face detection. If any abnormal behaviour was detected, it would trigger different configurable responses like outputting a signal to trigger a buzzer. Navigator is very suitable to both indoor and outdoor application and can be widely used in many scenarios such as schools, factories, buildings, gas stations, and natural spots and so on.

VIVOTEK : MA8391-ETV

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202402 mins

VIVOTEK has recently launched its multi-adjustable sensor dome camera, the MA8391-ETV. Featuring four independent 3-megapixel CMOS sensors, the MA8391- ETV allows users to simultaneously view four different areas while occupying only a single IP address. This not only reduces the installation time and total number of cameras needed, but also reduces management effort and maintenance costs. Due to its unique and small design, the camera is perfect for surveillance of large areas such as parking lots and shopping malls, as well as for spaces like hallways intersections and building corners. Building on its strategy of ‘see more in smarter ways,’ VIVOTEK new MA8391-ETV is especially equipped with four independent sensors. Each sensor features 3-megapixel and a 2.8 to 8 millimeters lens with remotefocus capability, allowing clients to both monitor wide spaces and retain a clear view of all details with the zoom-in function. This versatility makes operators able to remotely tune the zoom and focus of each individual lens precisely, enabling full 360° coverage. Furthermore, it deploys SNV (supreme night visibility) technology and a removable IR-cut filter, making it a true professional day and night camera. With an IK10 and IP66-rated housing and -40°C to 55°C operating temperature range, the MA8391-ETV is able to withstand rain and dust, and is safeguarded against vandalism and tampering when deployed for outdoor surveillance. MA8391-ETV is the smallest of its type with a diameter of 21 centimeters but still packs a powerful punch.

HIKVISION: Smart Parking Management Solution

MassMediaLink India LLP SecurityLink IndiaJanuary 19, 2018November 14, 202405 mins

With years of experience applying intelligent solutions in thousands of businesses around the world, Hikvision is set to make life easier for parking operators. With their state-of-the-art Smart Parking Management Solution, they masterfully improve the efficient management, security, and profitability objectives of parking operators. Effective access management For parking lots close to town centers or popular facilities, high customer flow during rush hours often creates parking entrance congestion. Effective parking safety and management are critical concerns here, especially in retail sectors. The Hikvision Smart Parking Management System applies the latest barrier technology, combining it with Hikvision’s industry-standard Automatic Number Plate Recognition (ANPR) to ensure seamless, managed vehicular entrance and exit from parking lots. Fast vehicle identification and integrated barrier control software means queues are minimised, and greater vehicle flow can be handled to increase the productivity and efficiency of any parking site. Advanced Hikvision DarkFighter and True WDR imaging technologies are employed in the ANPR system, as well as optional IR or built-in white light LED lighting. These industry-leading technologies ensure the delivery of crisp and clear recognition and recording of every vehicle using a parking lot day and night. Efficient parking guidance Parking Guidance cameras in this robust solution automatically monitor the use of the car park along with the availability of spaces, 24 hours a day. More sophisticated and useful than the usual ‘Spaces available’ sign, the system actually highlights the available parking spaces to customers and guides them to those spaces upon arrival. This is achieved via parking guidance display screens at critical junctions within the car park, which display the number and location of available parking spaces. Additionally, a dynamic lighting indicator system directs customers to a specific space available. ‘Find My Car’ feature Creating additional value and an improving end-user experience in a parking lot, the Hikvision Smart Parking Management System includes a ‘Find My Car’ feature. When returning to the parking lot, drivers can use the Query Kiosk touchscreen. By simply entering their license plate number in full or in part, vehicles can be easily located on a schematic floor map, and the vehicle location displayed, along with the shortest and quickest route to the vehicle. Centralised parking management Day-to-day management, including remote barrier control, license plate access management, vehicle accidents and unauthorised parking, can now be achieved with Hikvision’s centralised parking management platform. Providing the information and tools essential to ensuring smooth parking lot operation, the Hikvision Smart Parking Management Solution employs a central management platform that enables operators to deploy manpower, monitor a comprehensive facility overview, and respond to planned and unplanned events quickly and efficiently. The system can provide invaluable statistical and analytical parking lot information, helping operators maximise their profitability and supplying status history, parking usage rates, parking vehicle flow, and much more. Integration into third-party systems such as ‘Find My Car’, indoor navigation and payment systems are all supported by an Open SDK framework, allowing system integrators to provide operators with a solution that works for them.

Technology Laws & Cyber Security Essentials in New Age India

MassMediaLink India LLP SecurityLink IndiaJanuary 10, 2018November 14, 2024018 mins

Technology laws exist in India since 2000; however, with the advent of smart phones, and with wide internet penetration, the awareness and development of these laws have gradually increased. When I started practicing in cyber laws, smart phones were very new in India – a very few people owned them. But we have seen how during the last decade, society has changed and adapted to the technology, and also how technologies are being misused for committing frauds, thefts and other crimes. Over a few years, there has been an exponential rise in cyber-crimes – about 300% in the last one year in India alone. Today, there is a digital element everywhere. We find cyber-crime all around us, in various forms. Hacking, data theft, unauthorized access and cyber pornography are the most happening crimes. Besides, Internet has become a medium to commit conventional crimes such as theft, fraud and adultery. For example, most matrimonial offenses in divorce cases lie in the whatsapp chats, facebook posts and e-mails, which contain the evidence of adultery and cruelty. Online matrimonial portals have become the playground for fraudsters which are out to dupe gullible people seeking life partners. Social engineering is another way of phishing and vishing scams. I believe, almost every reader of this article must by now have received one or the other phishing/ vishing email with the subject ‘a beautiful woman is seeking a partner’ or an e-mail ‘proclaiming you have inherited a fortune,’ or a call ‘asking you to reset your debit card PIN number’ – all these clearly show how criminals have evolved from pick pocketing to committing credit/ debit card frauds and ATM skimming. Information Technology Act The Information Technology Act, 2000 (also known as ITA-2000, or the IT Act) is the primary law in India dealing with the cybercrime and electronic commerce. A brief outline of some of the provisions of the Act as amended in 2008 read with the Rules thereunder are elucidated hereunder. Section 66A This section was the one of the most controversial ones. It came in the limelight because under this section, arrests could be made for anything that caused annoyance or menace to another on the internet. It was struck off by the Supreme Court as the terms ‘menace’ and ‘annoyance’ are ambiguous and there can be no standard to define what is menacing or annoying for every individual in society. Section 43A This Section of the Information Technology Act imposes a liability of upto INR 5 crores on a body corporate who fails to secure the sensitive personal data of any individual which would include clients, employees and any other third parties whose data is stored by them. This is a very huge penalty and no other law in India imposes such a high penalty. There is a clear distinction between sensitive personal data and information (SPDI) and personal information (PI). SPDI includes, but is not limited to biometric information, sexual orientation, credit/ debit card data, and bank account details and passwords; whereas personal information (PI) includes any information which can be used to identify an individual like age, name, telephone number, address etc. The Intermediary Guidelines of 2011 render for an intermediary liable for failure to protect both SPDI and PI. Indian law is clearly very comprehensive that covers PI as well, unlike the laws of many countries which offer protection to SPDI only. There are provisions for penalizing for theft where any person receives or and retains a stolen computer device including smart phones (Section 66B); for identity theft where one uses the identity of someone else on the internet (66C); and for cyber impersonation where one impersonates as someone else on Internet (66D), including offenders who make fake social media profiles. Section 67, 67A and 67B deal with Cyber Pornography that do not render online pornography illegal. Creating and distributing pornography online is an offence however, downloading the same for private viewing is not an offence, with an exception of child pornography where even downloading is an offence. Duty of companies (Section 72A) Companies have a duty to protect the data of their clients and users especially if the same is contractually agreed. In case of failure, they are penalized under Section 72A of the Act. The Act defines an ‘Intermediary’ as any person who on behalf of another person stores or transmits a message or provides any service with respect to that message. This definition includes telecom service providers, internet service providers, web-hosting service providers, search engines, online-payment sites, online auction sites, online market places and cyber cafes. Section 79 of the Act is very crucial and provides respite to Intermediaries to some extent from an absolute liability. The requirement for liability under this section is the receipt of actual knowledge of offence by Intermediary and has been combined with a notice and take down duty. There is a time limit of 36 hours to respond to such a request and if an intermediary refuses to do so, it can be dragged to the court as a co-accused. These safe harbour provisions are available under the Amendment Act of 2008 only to an intermediary whose function is limited to giving access to a communication network over which information, made available by the third party, is transmitted or temporarily stored or where the intermediary does not initiate the transmission, does not select the receiver of the transmission and does not select or modify the information contained in the transmission. Authorities under the Act Cases of violations of the Information Technology Act are filed before the Adjudicating Officer appointed under this Act – one for each State. Appeals from the orders passed by Adjudicating Officer are filed before the Cyber Appellate Tribunal in New Delhi. The Court of the Adjudicating Officer is bound by the Rules of the Civil Procedure Code. An appeal from the Order of the Cyber Appellate Tribunal lies before the High Court, and appeals from all matters of the High Court lie before the Supreme…

Adopting New Approach to Cyber Security

MassMediaLink India LLP SecurityLink IndiaJanuary 10, 2018November 14, 202409 mins

In the last few years, cyber security has assumed tremendous significance. The number of cyber security breaches is constantly growing with each passing day. As a result, the annual cost of cybercrime is constantly increasing. As per a recent survey, it has been estimated that the total global cost of cybercrimes is expected to cross USD 6 trillion by 2021. Hence, the protection and preservation of cyber security becomes an important priority for all stakeholders. Author: Pawan Duggal – Advocate, Supreme Court of India Head, Pavan Duggal Associates, Advocates; & President, Cyberlaws.net In the Indian context, it is perceived that cyber security is primarily a governmental responsibility. However, nothing can be farther than the truth. Cyber security as a phenomenon refers to security of computer networks and computer systems which are used for accessing the electronic ecosystem. While it is absolutely clear that the Government is responsible for protection of cyber security of governmental networks, it also needs to be appreciated in the peculiar context of Indian conditions that a large number of computer systems constituting critical information infrastructure of the country are located in private hands. Examples include telecommunication networks, insurance networks and private banking networking, apart from private medical health network. In such a scenario, therefore, it becomes imperative that the private sector also needs to appreciate its responsibility of protecting and preserving cyber security Worldwide, the private sector is now increasingly being exposed to legal consequences for their failure to put in place security mechanisms to prevent hacking and other unauthorized access or cyber security breaches. The Ashley Madison website hacking case has brought to the fore front a renewed sensitization of a new kind of legal liability. The online dating website for married persons was hacked and subscriber details were made available. Consequently, legal actions have already been filed in the US for damages for the failure to put in place adequate security to protect the confidentiality of consumers’ data. Increasingly, companies now need to be prepared that they could potentially be sued for cyber security breaches and hence need to incorporate proactive cyber security legal compliances as an integral part of their day-to-day business operations. When one specifically examines the Indian context, it is clear that India does not have a dedicated law on cyber security. Indian cyber law is grounded in the Information Technology Act, 2000, which is a jack of all trades and master of none. Its amendments in 2008 incorporated various cosmetic amendments including giving a definition to the cyber security. The definition of cyber security inserted by virtue of the Information Technology (Amendment) Act, 2008 is broad enough to mean protecting information, equipment, devices, computer, computer resource, communication device and information stored therein from unauthorized access, use, disclosure, disruption, modification or destruction. Some provisions pertaining to breach of cyber security were added in the Information Technology Act, 2000 but they have not been invoked frequently or efficiently. Indian cyber law has also come up with the concept of intermediaries. All private and governmental service providers providing services on the network or dealing with third-party data are classified as intermediaries. Intermediaries under Indian cyber law are mandated to exercise due diligence while discharging their obligations under the law. Consequently, some parameters of due diligence were incorporated. In case, if an intermediary is dealing, handling sensitive personal data, additional compliances have been stipulated. Intermediaries are mandated to implement and maintain reasonable security practices and procedures while they deal, handle or process third party data. ISO 27001 standard has been recognised as one such methodology of reasonable security practices and procedures. However, when one looks at the complete set of duties and obligations stipulated for intermediaries, one will quickly realize that intermediaries have not been straddled with the responsibility for ensuring protection and preservation of cyber security. It will be a great step forward if the intermediaries are also handed the responsibility to protect and preserve cyber security. This becomes all the more important as cyber security is as strong as its weakest link and therefore the service providers need to be given the mandatory responsibility to contribute towards protection of cyber security. World over, intermediaries are now increasingly being straddled with these kind of responsibilities. Further, it is very unfair to expect that the Government would protect networks of the intermediaries when they are dealing, handling or processing third-party data. As such, the Indian law needs to take a stride forward. India needs to come up with a dedicated law on cyber security and needs to specifically address the various complex, complicated yet interconnected issues concerning cyber security ecosystems whether it is encryption, protection of critical information infrastructure, surveillance, monitoring, online liberty, privacy or any other aspect. The announcement of the Digital India program has been met with tremendous enthusiasm. For the success of the governmental programs like Digital India and Make in India, it becomes imperative that more focus needs to put on cyber security and the compliances of connected regulations by all stakeholders. As time passes by, India has to start inculcating the culture of cyber security as a way of life. We need to ensure that education concerning cyber security and cyber law needs to start at a very early age as an integral part of the school curriculum. In this regard, appropriate reforms in the education curriculum needs to be put in place. Cyber security today is presenting large amount of challenges and as such legal frameworks need to have appropriate flexibility so as to meet with the emerging challenges of the evolving paradigm of cyber security as time passes by.